0

I recently provisioned a Resource Group using ARM via Visual Studio. It has an Ubuntu VM running MongoDB that I can SSH into and interact with Mongo shell successfully.

I also have an App Site running a WebAPI that I want to be able to access the MongoDB using the Private IP (MongoDB should not be directly accessible on the Public IP). I've modified the bindIp setting in the mongo.conf file so that its bound to 127.0.0.1,10.0.0.4. Ive set the connection string in WebAPI to point to 10.0.0.4 with credentials (Ive tested credentials working using Mongo shell via SSH directly on the VM). Additionally there's a NIC, Virtual Network and the other resources (Link NIC, Storage etc). All resources are in the same resource group.

The error I'm seeing in Application Insights is:

System.Net.Sockets.SocketException: An attempt was made to access a socket in a way forbidden by its access permissions

Can anyone shed some light on why my Azure App Site (WebAPI) cannot access the MongoDB running on my Ubuntu VM - I've ran out of things to try.

Also I have added a GateWay Subnet and gone to the Networking node of the AppSite and tried to Setup VNET integration, however it shows my network greyed out with a little grey blob that upon hovering over reports that "The Virtual Network has no Gateway" - Im not entirely sure whether this is required or not but Ive created a GateWay Subnet resource regardless but it doesn't seem to help.

1 Answer 1

1

[...] tried to Setup VNET integration, however it shows my network greyed out with a little grey blob that upon hovering over reports that "The Virtual Network has no Gateway"

You're on the right track here.

First create a Gateway in your ARM Virtual Network:
Azure Portal → New → Virtual Network Gateway

Gateway Type: VPN
and
VPN Type: Route-based (which really means IKEv2)

Then add a Point-to-site address space on it for the Web App to VPN into. In Azure PowerShell:

# Add Point-to-site address space

$GatewayName = "YourGatewayName"
$RG = "YourResourceGroupName"
# The Point-to-site address space MUST NOT OVERLAP with the Virtual Network address space
$P2SAddressSpace = "172.16.1.0/24"

Set-AzureRmVirtualNetworkGatewayVpnClientConfig -VirtualNetworkGateway `
                 (Get-AzureRmVirtualNetworkGateway -Name $GatewayName `
                                                   -ResourceGroupName $RG) `
                 -VpnClientAddressPool $P2SAddressSpace -Verbose

Wait a few minutes for the Gateway to update, then go back to the Web App -> Network -> VNET Integration and select the Gateway.

That's all.

4
  • Hey thanks so much for your answer, Im trying to implement now but how do I find the correct value for $P2SAddressSpace = "172.16.1.0/24" and ensure it doesnt conflict?
    – bUKaneer
    Aug 5, 2016 at 14:02
  • Just make sure it doesn't overlap with your VNET or site-to-site VPN (if you have one) address space. Then you can use any private IP space, like 172.16.1.0/24 or 192.168.1.0/24.
    – evilSnobu
    Aug 5, 2016 at 14:44
  • Thanks lots this seems to have got us past the pain point - now just have to figure out why our WebAPI still cant talk to the MongoDB server but your answer was spot on for setting up the VNET thanks!
    – bUKaneer
    Aug 5, 2016 at 15:41
  • Check NSG rules, OS firewall, mongo listen config.
    – evilSnobu
    Aug 5, 2016 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .